root
/
openssl
mirror of https://github.com/openssl/openssl.git
1
0
Fork 0
Code Issues Actions 7 Packages Projects Releases Wiki Activity

Don't apply max_frag_len checking if no Max Fragment Length extension 

Don't check the Max Fragment Length if the it hasn't been negotiated. We
were checking it anyway, and using the default value
(SSL3_RT_MAX_PLAIN_LENGTH). This works in most cases but KTLS can cause the
record length to actually exceed this in some cases.

Fixes #23169

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23182)

(cherry picked from commit c1decd6246)
This commit is contained in:
Matt Caswell 2024-01-02 16:48:43 +00:00
parent 523d1233f1
commit 141365d1b4
1 changed files with 10 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
ssl/record/methods/tls_common.c
View File

@ -916,11 +916,17 @@ int tls_get_more_records(OSSL_RECORD_LAYER *rl)
}
/*
* Check if the received packet overflows the current
* Max Fragment Length setting.
* Note: rl->max_frag_len > 0 and KTLS are mutually exclusive.
* Record overflow checking (e.g. checking if
* thisrr->length > SSL3_RT_MAX_PLAIN_LENGTH) is the responsibility of
* the post_process_record() function above. However we check here if
* the received packet overflows the current Max Fragment Length setting
* if there is one.
* Note: rl->max_frag_len != SSL3_RT_MAX_PLAIN_LENGTH and KTLS are
* mutually exclusive. Also note that with KTLS thisrr->length can
* be > SSL3_RT_MAX_PLAIN_LENGTH (and rl->max_frag_len must be ignored)
*/
if (thisrr->length > rl->max_frag_len) {
if (rl->max_frag_len != SSL3_RT_MAX_PLAIN_LENGTH
&& thisrr->length > rl->max_frag_len) {
RLAYERfatal(rl, SSL_AD_RECORD_OVERFLOW, SSL_R_DATA_LENGTH_TOO_LONG);
goto end;
}